ssh配置authorized_keys後仍然需要輸入密碼的相關問題

來源:互聯網
上載者:User

前陣子搭建Hadoop時,配置了本機(localhost)的ssh的公開金鑰到authorized_keys檔案中,但是在ssh串連localhost時仍然提示需要輸入密碼,後來發現是$HOME/.ssh/authorized_keys這個檔案的許可權問題引起的。其原因是,不能讓所有者之外的使用者對authorized_keys檔案有寫入權限,否則,sshd將不允許使用該檔案,因為它可能會被其他使用者篡改。
命令列的示範如下:

[hadoop@guest1 ~]$ cd .ssh/[hadoop@guest1 .ssh]$ lltotal 16-rw-rw-r--1 hadoop hadoop  395 Jan 1218:37 authorized_keys-rw-------1 hadoop hadoop 1675 Jan 1218:36 id_rsa-rw-r--r--1 hadoop hadoop  395 Jan 1218:36 id_rsa.pub-rw-r--r--1 hadoop hadoop  796 Jan  6 08:40 known_hosts#注意這裡的authorized_keys檔案的許可權;這時該檔案中的key是不起作用的。#用chmod修改authorized_keys檔案的許可權[hadoop@guest1 .ssh]$ chmod g-w authorized_keys[hadoop@guest1 .ssh]$ lltotal 16-rw-r--r--1 hadoop hadoop  395 Jan 1218:37 authorized_keys-rw-------1 hadoop hadoop 1675 Jan 1218:36 id_rsa-rw-r--r--1 hadoop hadoop  395 Jan 1218:36 id_rsa.pub-rw-r--r--1 hadoop hadoop  796 Jan  6 08:40 known_hosts               #修改後,sshd就可以正常使用authorized_keys檔案了[hadoop@guest1 ~]$ ssh localhostLast login: Sat Jan 1218:40:332013 from localhost[hadoop@guest1 ~]$ exitlogoutConnection to localhost closed.[hadoop@guest1 ~]$


後來,我詳細查了一下,如果authorized_keys檔案、$HOME/.ssh目錄 或 $HOME目錄讓本使用者之外的使用者有寫入權限,那麼sshd都會拒絕使用 ~/.ssh/authorized_keys 檔案中的key來進行認證的。
“man sshd”命令查看對authorized_keys檔案的描述如下:

man sshd.....     ~/.ssh/authorized_keys             Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in as this user.  The format of             this file is described above.  The content of the file is not highly sensitive, but the recommended             permissions are read/write for the user, and not accessible by others.                 If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the             file could be modified or replaced by unauthorized users.  In this case, sshd will not allow it to be             used unless the StrictModes option has been set to “no”.........


聯繫我們

該頁面正文內容均來源於網絡整理,並不代表阿里雲官方的觀點,該頁面所提到的產品和服務也與阿里云無關,如果該頁面內容對您造成了困擾,歡迎寫郵件給我們,收到郵件我們將在5個工作日內處理。

如果您發現本社區中有涉嫌抄襲的內容,歡迎發送郵件至: info-contact@alibabacloud.com 進行舉報並提供相關證據,工作人員會在 5 個工作天內聯絡您,一經查實,本站將立刻刪除涉嫌侵權內容。

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.